IE 4 has hyperlink bug

Microsoft(MSFT) last night posted a fix to an Internet Explorer 4.0 bug that could turn a hyperlink into a hornet's nest.

The company yesterday confirmed the existence of what it is calling the buffer-overrun security bug. The bug allows a malicious Web site author to take advantage of IE 4.0's limited capacity for Web addresses of the "res://" type.

Here's how it works: IE 4.0 can only read a res:// hyperlink address of up to 256 characters. Anything longer than that crashes the browser and causes the remaining characters of the address to go into the computer's memory. A malicious Web site author can make trouble simply by writing hostile code from the 257th character of the res:// address.